This invention relates to redundant control systems useful in the operation of actuators for control of fuel valve and vanes in a turbine engine, as well as in the control of other mechanical devices and, more particularly, to the implementation of a network of redundant control elements wherein one part of the network employs triplex redundancy and the second part of the network employs duplex redundancy.
Control systems are employed in the operation of complex mechanical devices, such as engines, and apparatus for control of industrial processes. While relatively simple devices can be operated under control of a person, the more complex devices require a control system which aids the person in operating the device. One such device, of considerable interest herein, is a turbine engine suitable for powering an aircraft. A modern aircraft turbine engine has a plurality of parameters which are to be regulated in response to various measurements of temperature, pressure and gas flow to optimize efficiency and to provide desired thrust under various operating conditions. This is accomplished by use of a control system which adjusts settings of inlet guide vanes and exhaust nozzle area in conjunction with the regulation of their flow to a core engine and an augmentor.
Due to requirements of maintaining maximum safety, it is imperative to employ redundant elements in a control system to ensure that acceptable control of the engine is provided even if a defect or failure appears in one of the elements of the control system. It has been the practice to employ triple redundancy of the electronic control units which provide for the scheduled amounts of fuel flow and variable geometry positions in response to various input variables of temperature, pressure, and core or fan speed in an engine having an assembly of plural compressor elements and plural turbine elements. The redundancy is carried forth in each channel of the system for control of respective ones of the output variables such as fuel flow and variable geometry position.
In each of the channels, a servomechanism including a servo actuator is provided for moving a variable engine function in response to an electrical signal inputted to the actuator. The triple redundancy has been carried forth even into the input ports of the actuator such that three mechanical elements are separately driven by three redundant electrical signals to move the actuator. The three electrical signals are produced by the three separate channels within the electronic control unit (ECU). Also, multiple sensors may be employed for sensing a single input variable, such as inlet temperature to the high-pressure compressor, to provide for the feature of redundancy throughout the control system from the sensors through the channels of the control unit and into the input ports of the actuator.
A problem arises in that the level of reliability has increased in some elements of the control system to the point where it is more efficient to employ only duplex redundancy rather than triplex redundancy. For example, at the input ports of the actuator, there is a significant savings in both weight and complexity of the mechanical and electrical interconnections between the actuator and the set of electronic control units inherent in the redundant equipment. A significant savings in weight and complexity can be obtained by reducing the appropriate portion of the redundancy to duplex redundancy from the previously employed triplex redundancy. In addition, power amplifiers of the input channels to the servo mechanism can be operated at one-half their maximum power rating rather than at one-third their maximum power rating upon a reduction of the redundancy from triplex to duplex. Greater linearity and dynamic response can be obtained by operating the amplifiers at half the power rating rather than at one-third the power rating. With respect to the reduction of the number of signal paths in a channel, it is noted that the level of reliability is not necessarily the same for all elements within a channel.